PT-2022-13173 · Supsystic · The Popup By Supsystic

Felipe De Avila · Published 2022-05-09 · Updated 2023-01-31 · CVE-2022-0424

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Popup by Supsystic WordPress plugin versions prior to 1.10.9

Description The issue concerns a lack of authentication and authorization in an AJAX action, allowing unauthenticated attackers to call it and obtain the email addresses of subscribed users.

Recommendations For versions prior to 1.10.9, update to version 1.10.9 or later to resolve the issue. As a temporary workaround, consider disabling the vulnerable AJAX action until a patch is available. Restrict access to the AJAX endpoint to minimize the risk of exploitation. Avoid using the affected plugin until the issue is resolved.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2022-0424

Affected Products

The Popup By Supsystic

References · 4

• 🔥 https://wpscan.com/vulnerability/1e4593fd-51e5-43ca-a244-9aaef3804b9f · Exploit
• https://osv.dev/vulnerability/CVE-2022-0424 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0424 · Security Note
• https://t.me/cibsecurity/42194 · Telegram Post